How to be anonymous on social media

How to protect your identity depending on whom you're hiding from.

Published July 12, 2025 – By Naomi Brockwell

Using a pseudonym on social media can be an incredibly valuable way to reclaim your privacy online. In an age where digital footprints last forever, the ability to separate your online identity from your real-world persona is more important than ever.

Maybe you're concerned about protecting yourself from online mobs that might target your job, your family, or your personal reputation. Maybe you don't want everything you say online to be permanently linked to your real name. Perhaps you have multiple interests or roles in life (professional, personal, creative) and want to maintain separate identities for each.

Maybe you simply value your privacy. Having a pseudonymous account can be liberating. It allows you the freedom to explore new ideas, revise your beliefs, and reinvent yourself without every past opinion you’ve ever expressed being etched in stone and forever tied to you.

But setting up a pseudonymous account on social media isn’t always straightforward. Your approach will depend heavily on the platform you're using. It will also depend on your threat model, which you can think of as whom you’re trying to hide your identity from, how private you need to be, and what’s at stake.

Threat models

It's essential to understand your own threat model clearly, because the steps you’ll need to take to create a pseudonymous social media identity will vary dramatically at each level. For example, hiding your opinions from your boss will require very different precautions than hiding from a hostile government that wants to target you for your political beliefs.

There are countless threat models, but here are 3 general categories to give you some ideas of where you might fit in:

1. Hiding from the general public, and preventing low-level insider doxxing

This is an easier level to achieve. You simply don't want your boss, colleagues, or random strangers linking your social media activity back to your real identity.

2. Hiding from the platform itself

Perhaps you have a higher profile, and you’re concerned about a platform employee accessing your personal details, billing information, or potentially doxxing you. At this level, you're not being actively targeted, but you also don’t want the platform to know who you are. Protecting your identity here gets trickier and requires a deeper understanding of internet tracking and more rigorous control over your digital footprint.

3. Hiding from a hostile government that is targeting you

This is an extreme threat scenario. Perhaps you live under a hostile regime where political dissent is dangerous and consequences for being identified online can be severe. This level of threat requires meticulous discipline, and a tailored approach that goes far beyond general privacy advice. We won’t cover this threat model in this newsletter -- not because it isn’t important, but because the stakes are too high for shortcuts. If your life or freedom could be at risk, please seek help from security professionals who specialize in operating anonymously under repressive conditions. Even small mistakes can be catastrophic.

Some organizations you might reach out to include:

Let’s use X as an example

Depending on which social media platform you want to use, the steps for setting up a pseudonymous account will vary dramatically. In this article, we’ll just focus on X as one example, because it’s a popular platform where pseudonymous accounts thrive. While Facebook aggressively pushes users to use real names and actively works to de-anonymize its users, X is a place where personas, satire accounts, and anonymous commentary are quite common.

That said, pseudonymity is a delicate privacy layer that can easily be broken. In this article, we are not providing exhaustive checklists, but rather examples of what kinds of mistakes lead to deanonymization, and tips for better protecting yourself.

Threat model 1: Hiding from the general public, and preventing low-level insider doxxing

Goal:
You simply don’t want random people or followers connecting your tweets to your real identity. You want to ensure that even the average X employee with backend access won’t immediately be able to see your real identity linked to your pseudonymous account. Perhaps you're worried about accidental exposure, corruption, or misuse of internal access.

Tips:

  • Choose a completely separate profile name and username
    • Select a pseudonym that has no obvious connection to your real-world identity (avoid birthdays, locations, or nicknames).
  • Create a new email address (use an email alias service)
    • Don’t reuse your personal or work email. Use an email alias service (like SimpleLogin) that you only ever use for this account.
    • Even though your email address isn’t publicly visible on your profile, data breaches are extremely common. Presume that your credentials will be leaked. If your email ties back to your real identity, your pseudonym is blown.
  • Use a VoIP number for verification
    • Your personal cell number is a unique identifier that's already been leaked everywhere. If you use it for verification, a data breach could link your identity to your pseudonymous account.
    • Use a VoIP service like MySudo or Cloaked to generate a clean, separate number.
  • Avoid personal identifiers
    • Don’t include real-world hobbies, your profession, specific locations, or distinctive personal details in your profile or posts.
  • Be careful whom you follow
    • Don’t follow your real account or people closely tied to you (e.g., best friend, sibling, coworker). These connections can unravel your anonymity.
  • Profile pictures and images
    • Don’t reuse photos from other accounts (reverse image searches can link them).
    • Consider AI-generated or royalty-free images.

These are some general tips that will help you. Just remember: any link, reference, or overlap between your pseudonymous account and real identity can risk exposure.

Threat model 2: Hiding from the platform itself

Goal:
You want to prevent the platform (X) from identifying you. This involves more sophisticated steps to scrub your digital footprint and reduce the metadata you leak by default.

This guide is not intended for people in life-threatening situations or under hostile regimes. It’s a conceptual framework for lower-risk scenarios, where the goal is to increase your privacy, not guarantee anonymity. Also keep in mind that this is not an exhaustive list -- it's a starting point for awareness, not a guarantee of protection.

This model assumes you’ve already followed all steps from Threat Model 1. From here, you're adding aggressive compartmentalization, anonymization, and metadata hygiene.

Core protections

  • Minimize metadata exposure
    • Always strip EXIF data from images before uploading. Use privacy-friendly tools (see our video on metadata scrubbing).
  • Use a masked or virtual payment method
    • If you subscribe to X Premium, use a virtual card like Privacy.com to avoid exposing your billing info. You can enter a fake name and billing address, and the payment will still go through (we talk about masked credit cards in this video).
  • Always use a VPN
    • VPNs help hide your IP address from the platform. Choose one that doesn't log (e.g., Mullvad, ProtonVPN). Use it consistently.
  • Careful device management
    • Access X only via a privacy-focused browser (like Brave), never the app. Apps collect far more data and can bypass system-level protections, often in a super sneaky way that users don’t even know about.
    • Use a dedicated browser profile or even a separate browser just for your pseudonymous identity. This prevents cross-contamination from cookies, autofill, and history.

Advanced protections

  • Never use personal internet connections
    • Avoid using home, work, or school Wi-Fi. Use public networks far from places associated with you.
    • Pay for your VPN anonymously (cash, crypto, gift card). Consider adding Tor as an additional layer.
  • Avoid platform fingerprinting
    • Disable JavaScript when feasible.• Avoid using a unique combination of extensions that can fingerprint you.
    • Regularly rotate browser profiles and clear cookies, local storage, and cache.
    • Consider disabling advanced fingerprinting vectors like canvas rendering and WebGL.
  • Make sure email and phone have also been set up anonymously
    • Your email should be created using anonymous methods and not linked to anything else you use.
    • Your VoIP number should also be generated in a way that avoids personal identifiers. Accidental crossover is one of the most common ways people get deanonymized.
  • Avoid revealing patterns
    • Vary your writing style and posting schedule.
    • Don’t engage with people or topics tied to your real-world identity.
    • Avoid posting about events or niche communities that could reveal your location or background.
  • Understand legal and jurisdictional risks
    • Be aware of keywords and behavior that could flag surveillance systems.
  • Don’t trust devices
    • Don’t bring your pseudonymous device near your home or workplace.
    • Wi-Fi probes and Bluetooth signals can reveal patterns.
    • Disable or remove mics/cameras where possible.
  • Use dedicated hardware and OS
    • Use a separate device that’s never touched your real accounts.
    • If that’s not possible, use isolated OSes (like Virtual Machines, Tails OS, Qubes OS) for advanced compartmentalization
    • Always wipe and reinstall OS if using secondhand hardware.• Never log in to pseudonymous and personal accounts from the same browser or device.
  • Limit interaction with the platform
    • Don’t click on X notifications or emails (they often contain trackers).
    • Avoid engaging unless it’s strategic.
  • Maintain a rotation schedule
    • Periodically “burn” your pseudonymous account and start fresh: new device, new email, new behavior.
    • The longer an identity lives, the more data accumulates.
    • Keep your footprint minimal and delete what you no longer need.

Threat model 3: Hiding from the government in a high-risk environment

Goal:
You live under a hostile regime where expressing dissenting opinions online carries severe consequences. For instance, you might be in Turkey, China, Iran, or another environment known for targeting political opponents, activists, or critical voices.

Is true anonymity possible?

Let’s be clear: achieving absolute, foolproof anonymity online is extraordinarily difficult. Governments have massive resources -- they have surveillance infrastructure, legal coercion, and advanced forensic tools. One small mistake can unravel everything.

This guide does not offer operational security for high-risk environments. If your life or freedom are on the line, consult with trained security professionals. Do not rely on generalized privacy guides.

What would that involve?

Just to give you a sense of what’s involved, you’d need to consider:

  • Buying hardware anonymously and avoiding camera networks
  • Creating burner accounts and rotating them frequently
  • Maintaining total behavioral and linguistic separation
  • Never discussing pseudonymous work, even with trusted friends
  • Compartmentalizing your life with extreme precision

And this is just the beginning. If this sounds overwhelming, that’s because it is.

If you’re in this situation: don’t go it alone.
Your safety is worth getting help.

The good news

The good news is that most people’s threat model doesn’t involve being specifically targeted by the government. What does that mean exactly? Targeting an individual requires considerable time, effort, and cost, so governments rarely do it unless there’s a clear reason. Instead, they rely on mass surveillance: automated systems that vacuum up data at scale and piece together your identity from the information you (or your devices) voluntarily give away.

And that’s why this is good news: most of this exposure is preventable. You don’t need extreme measures to protect yourself, you just need better defaults. By using VoIP numbers, email aliases, and privacy-focused browsers, you can significantly reduce how much of your life is available for collection in the first place. Small changes in behavior can go a long way toward protecting your identity and limiting what’s visible to mass surveillance systems.

Final thoughts

For most people, achieving basic pseudonymity online is much easier than it sounds. If your goal is to keep your professional life separate from your online commentary, or just to prevent casual Googling from exposing your social media presence, a thin veil of anonymity can go a long way. Choosing a new name, using a separate email and phone number, and keeping your circles compartmentalized are often all you need.

If you want a stronger break between your real identity and your online persona, you can layer on more privacy tools like VPNs, burner devices, and metadata hygiene. These steps aren’t just for activists or whistleblowers, they’re increasingly useful for anyone who wants to reclaim a sense of control in a world of hyper-connected data.

But if your life or freedom truly depends on staying anonymous -- if you are being targeted by a government or powerful institution -- then the game changes. In high-risk situations, pseudonymity becomes fragile. One careless follow, one reused phone number, one unstripped photo is all it takes to unravel everything. You need airtight operational security, and professional guidance to match the stakes.

No matter where you fall on that spectrum, this guide is here to help you think critically about how you engage online, and to offer practical, achievable steps that meet you where you are. Privacy is not a one-size-fits-all endeavor. What matters most is understanding your threat model, being consistent in your habits, and staying aware of the tradeoffs you're making.

Every privacy step you take makes a difference.

 

Your in privacy,
Naomi

Naomi Brockwell is a privacy advocacy and professional speaker, MC, interviewer, producer, podcaster, specialising in blockchain, cryptocurrency and economics. She runs the NBTV channel on Rumble.

TNT is truly independent!

We don’t have a billionaire owner, and our unique reader-funded model keeps us free from political or corporate influence. This means we can fearlessly report the facts and shine a light on the misdeeds of those in power.

Consider a donation to keep our independent journalism running…

Breakthrough could give China unlimited nuclear energy

Published November 15, 2025 – By Editorial staff

The Shanghai Institute of Applied Physics, a Chinese research institute, has successfully converted thorium into uranium in an experimental reactor, enabling nearly unlimited access to nuclear energy.

The two-megawatt molten salt reactor is the world's only functioning facility of its kind.

The experiment has, according to the Chinese Academy of Sciences, demonstrated that thorium-based technology is technically feasible in molten salt reactors and represents a significant breakthrough. It is the first time researchers have been able to collect experimental data from thorium operation in such a reactor, reported the newspaper Science and Technology Daily.

The reactor has produced heat through nuclear fission since reaching criticality on October 11, 2023, according to Li Qingnuan, party secretary and deputy director at the institute.

Superior fuel availability

Thorium exists in much larger quantities and is more readily available than uranium. A single mining waste site in Inner Mongolia is estimated to contain enough thorium to supply all of China with energy for over a thousand years.

The new technology is based on a process where naturally occurring thorium-232 is converted into uranium-233 inside the reactor core. Thorium-232 absorbs a neutron and becomes thorium-233, which then decays into protactinium-233 and finally into uranium-233 – a fissile material that can sustain nuclear reactions.

The thorium is dissolved in a fluoride salt that forms a high-temperature molten mixture which functions as both fuel and coolant. The system creates a self-sustaining cycle where the reactor "breeds" fuel while simultaneously producing energy.

Requires no water cooling

Unlike conventional reactors, the thorium reactor requires no water at all for cooling, allowing it to be located in dry inland areas. The molten fluoride salts efficiently transfer heat at atmospheric pressure and extreme temperatures.

Safety is, according to the developers, significantly higher than in traditional reactors because the system operates at atmospheric pressure, eliminating the risk of high-pressure explosions. In the event of a leak, the molten salt would flow into a passive collection tank where it would solidify.

The reactor reached full power in June 2024, and in October of the same year, the world's first experiment with adding thorium to a molten salt reactor was conducted. China is now building a 100-megawatt demonstration reactor in the Gobi Desert with the goal of proving the technology is commercially viable around 2035.

Watch as Russia’s AI robot falls on stage

Published November 13, 2025 – By Editorial staff

Russia's first humanoid AI robot fell on stage during its official launch in Moscow this week. Staff rushed forward to shield the damaged robot while attempting to fix the malfunction.

What was meant to be a grand launch of Russia's venture into humanoid robotics ended in embarrassment. To the sounds from the Rocky film, the robot AIdol was led onto the stage by two staff members at a technology event in the Russian capital.

But the presentation ended in chaos when the robot lost its balance and crashed to the ground. Several parts came loose and staff hurried to pull the machine away and hide it behind a screen.

Behind the project is the Russian robotics company Idol, led by Vladimir Vitukhin. According to the company, AIdol is an advanced robot built mostly from domestic components.

Vitukhin explained the fall as a calibration problem and emphasized that the robot is still in the testing phase.

This is real-time learning, when a good mistake turns into knowledge, and a bad mistake turns into experience, Vitukhin said, according to Newsweek.

Despite the company's attempts to downplay the incident, criticism has been massive on Russian tech forums and social media. Many question the decision to showcase an obviously unfinished prototype.

AIdol is powered by a 48-volt battery that provides up to six hours of operation. The machine is equipped with 19 servo motors and a silicon skin designed to recreate human facial expressions.

The robot can smile, think, and be surprised – just like a person, Vitukhin said.

According to reports, AIdol consists of 77 percent Russian-produced components. After the fall, developers have withdrawn the machine while engineers examine the balance systems.

Italian political consultant became victim of spyware program

Totalitarianism

Published November 11, 2025 – By Editorial staff
Francesco Nicodemo.

An Italian political advisor who worked for center-left parties has gone public about being hacked through an advanced Israeli-developed spyware program. Francesco Nicodemo is the latest in a growing list of victims in a spyware scandal that is shaking Italy and raising questions about how intelligence services use surveillance technology.

Francesco Nicodemo, who works as a consultant for left-leaning politicians in Italy, waited ten months before publicly disclosing that he had been targeted by the Paragon spyware program. On Thursday, he chose to break his silence in a post on Facebook.

Nicodemo explained that he had previously not wanted to publicize his case because he "didn't want to be used for political propaganda," but that "the time has now come".

"It's time to ask a very simple question: Why? Why me? How is it possible that such a sophisticated and complex tool was used to spy on a private citizen, as if he were a drug dealer or a subversive threat to the country?", Nicodemo wrote. "I have nothing more to say. More people must speak out. Others must explain what happened".

Extensive scandal grows

Nicodemo's revelation once again expands the scope of the ongoing spyware scandal in Italy. Among those affected are several journalists, migration activists, prominent business leaders, and now a political consultant with a history of working for the center-left party Partito Democratico and its politicians.

The online publication Fanpage reported first that Nicodemo was among the people who received a notification from WhatsApp in January that they had been targeted by the spyware program.

Questions about usage

Governments and spyware manufacturers have long claimed that their surveillance products are used against serious criminals and terrorists, but recent cases show that this is not always the case.

— The Italian government has provided certain spyware victims with clarity and explained the cases. But others remain disturbingly unclear, says John Scott-Railton, a senior researcher at The Citizen Lab who has investigated spyware companies and their abuses for years.

None of this looks good for Paragon, or for Italy. That's why clarity from the Italian government is so essential. I believe that if they wanted to, Paragon could give everyone much more clarity about what's going on. Until they do, these cases will remain a burden on their shoulders, adds Scott-Railton, who confirmed that Nicodemo received the notification from WhatsApp.

Intelligence services' involvement

It is still unclear which of Paragon's customers hacked Nicodemo, but an Italian parliamentary committee confirmed in June that some of the victims in Italy were hacked by Italian intelligence services, which report to Prime Minister Giorgia Meloni's government.

In February, following revelations about the first victims in Italy, Paragon severed ties with its government customers in the country, specifically the intelligence services AISE and AISI.

The parliamentary committee COPASIR later concluded in June that some of the publicly identified Paragon victims, namely the migration activists, had been legally hacked by Italian intelligence services. However, the committee found no evidence that Francesco Cancellato, editor of the news site Fanpage.it which had investigated the youth organization of Meloni's governing party, had been hacked by the intelligence services.

Paragon, which has an active contract with the U.S. Immigration and Customs Enforcement agency, states that the U.S. government is one of its customers.

FACTS: Paragon

Paragon Solutions is an Israeli cybersecurity company that develops advanced spyware for intelligence services and law enforcement agencies. The software can be used to monitor smartphones and other digital devices.

The company was acquired by American private equity giant AE Industrial and has since been merged with cybersecurity firm REDLattice. Paragon's clients include the US government, including the Immigration and Customs Enforcement (ICE) agency.

In February 2024, Paragon terminated its contracts with Italian intelligence services AISE and AISI after several Italian citizens, including journalists and activists, were identified as victims of the company's spyware.

Paragon is marketed as a tool against serious crime and terrorism, but its use in Italy has raised questions about whether the spyware is also being used against political opponents and journalists.

Email was never built for privacy

Mass surveillance

How Proton makes email privacy simple.

Published November 8, 2025 – By Naomi Brockwell

Email was never built for privacy. It’s closer to a digital postcard than a sealed letter, bouncing through and sitting on servers you don’t control, and mainstream providers like Gmail read and analyze everything that is inside.

Email isn’t going anywhere in our society, it’s baked into how the digital world communicates. But luckily there are ways to make your emails more private. One tool that you can use is PGP, which stands for “Pretty Good Privacy”.

PGP is one of the oldest and most powerful tools for email privacy. It takes your message and locks it with the recipient’s public key, so only they can unlock it with their private key. That means even if someone intercepts the email, whether it’s a hacker, your ISP, or a government agency, they see only scrambled text.

Unfortunately it is notoriously complicated. Normally, you’d have to install command-line tools, generate keys manually, and run cryptic commands just to send an encrypted email.

But Proton Mail makes all of that easy, and builds PGP right into your inbox.

How Proton makes PGP simple

Proton is a great, privacy-focused email provider (and no they’re not sponsoring this newsletter, they’re simply an email provider that I like to use).

If you email someone within the Proton ecosystem (ie send an email from one Proton user to another Proton user), your email is automatically end-to-end encrypted using PGP.

But what if you email someone outside of the Proton ecosystem?

Here’s where it would usually get tricky.

First, you’d need to install a PGP client, which is a program that lets you generate and manage your encryption keys.

Then you’d run command-line prompts, choosing the key type, size, expiration, associating the email you want to use the key with, and you’d export your public key. It’s complicated.

But if you use Proton, they make using PGP super easy.

Let’s go through how to use it.

Automatic search for public PGP key

First of all, when you type an email address into the “To” field in Proton Mail, it automatically searches for a public PGP key associated with that address. Proton checks its own network, your contact list, and Web Key Directory (WKD) on the associated email domain.

WKD is a small web‑standard that allows someone to publish their public key at their domain in a way that makes it easily findable for an email app. For example if Proton finds a key for a certain address at the associated domain, Proton will automatically encrypt a message with it.

If they find a key, you’ll see a green lock next to the recipient in the ‘To’ field, indicating the message will be encrypted.

You don’t need to copy, paste, or import anything. It just works.

Great, your email has been automatically encrypted using PGP, and only the recipient of the email will be able to use their private key to decrypt it.

Manually uploading someone’s PGP key

What if Proton doesn’t automatically find someone’s PGP key? You can hunt down the key manually and import it. Some people will have their key available on their website, either in plain text, or as a .asc file. Proton allows you to save this PGP key in your contacts.

To add one manually, first you type their email address in the “to” field.

Then right-click on that address, and select “view contact details”

Then click the settings wheel to go to email settings, and select “show advanced PGP settings”

Under “public keys”, select “upload” and upload their public key in an .asc format.

Once the key is uploaded, the “encrypt emails” toggle will automatically switch on, and all future emails to that contact will automatically be protected with PGP. You can turn that off at any time, and also remove or replace the public key.

How do others secure emails to you using PGP?

Super! So you’ve sent an encrypted email to someone using their PGP key. What if they want to send you an email back, will that be automatically end-to-end encrypted (E2EE) using PGP? Not necessarily.

In order for someone to send you an end-to-end encrypted email, they need your public PGP key.

Download your public-private key pair inside Proton

Proton automatically generates a public-private key pair for each address that you have configured inside Proton Mail, and manages encryption inside its own network.

If you want people outside Proton to be able to encrypt messages to you, the first step is to export your public key from your Proton account so you can share it with them.

To do this:

  • Go to Setting
  • Click “All settings”
  • Select “encryption and keys”
  • Under “email encryption keys” you’ll have a dropdown menu of all your email addresses associated with your Proton account. Select the address that you want to export the public key for.
  • Under the “action” column, click “export public key”

It will download as an .asc file, and ask you where you want to save the file.

Normally a PGP key is written in 1s and 0s that your computer can read. The .asc file takes that key and wraps it in readable characters, and it ends up in a format that looks something like this:

Sharing your public key

Now that you’ve downloaded the public key, how do you share it with people so that they can contact you privately? There are several ways.

For @proton.me and @protonmail.com addresses, Proton publishes your public key in its WKD automatically. You don’t have to do anything.

For custom domains configured in Proton Mail, Proton doesn’t host WKD for you. You can publish WKD yourself on your own domain by serving it at a special path on your website. Or you can delegate WKD to a managed service. Or if you don’t want to use WKD at all, you can upload your key to a public keyserver like keys.openpgp.org, which provides another way for mail apps to discover it.

We’re not going to cover those setups in this article. Instead here are simpler ways to share your public key:

1) You can send people your .asc file directly if you want them to be able to encrypt emails to you (be sure to let them know which email address is associated with this key), or you can host this .asc file on your website for people to download.

2) You can open the .asc file in a text editor and copy and paste the key, and then send people this text, or upload the text on your website. This is what I have done:

This way if anyone wants to send me an email more privately, they can do so.

But Proton makes it even easier to share your PGP key: you can opt to automatically attach your public key to every email.

To turn this on:

  1. Go to Settings → Encryption & keys → External PGP settings
  2. Enable
    • Sign external messages
    • Attach public key

Once this is on, every email you send will automatically include your public key file, as a small .asc text file.

This means anyone using a PGP-capable mail client (like Thunderbird, Mailvelope, etc.) can import it immediately, with no manual steps required.

Password-protected emails

Proton also lets you send password-protected emails, so even if the other person doesn’t use PGP you can still keep the contents private. This isn’t PGP -- Proton encrypts the message and attachments in your browser and the recipient gets a link to a secure viewing page. They enter a password you share separately to open it. Their provider (like Gmail) only sees a notification email with a link, not the message itself. You can add a password hint, and the message expires after a set time (28 days by default).

The bottom line

Email privacy doesn’t have to be painful. Proton hides the complexity by adding a password option, or automating a lot of the PGP process for you: it automatically looks up recipients’ keys, encrypts your messages, and makes your key easy for others to use when they reply.

As Phil Zimmermann, the creator of PGP, explained in Why I Wrote PGP:

“PGP empowers people to take their privacy into their own hands. There has been a growing social need for it. That’s why I wrote it".

We’re honored to have Mr. Zimmermann on our board of advisors at Ludlow Institute.

Pioneers like him fought hard so we could protect our privacy. It’s on us to use the tools they gave us.

 

Yours in privacy,
Naomi

Naomi Brockwell is a privacy advocacy and professional speaker, MC, interviewer, producer, podcaster, specialising in blockchain, cryptocurrency and economics. She runs the NBTV channel on Rumble.